At this point we're not gathering new data. At least not in my group. We're working on converting really old data and applications into merely old applications. 😉 I'm joking, of course. I mean that the new applications we're working on, although more modern, aren't current technologies. The crucial point is that the data isn't something new, such as gathering voice or facial data for recognition, which we've never done before. Instead, it's taking really old data stored in essentially flat files (in MS Access databases, but without much relational structure in place), then migrating them to better structured, relational databases.
In some cases, there is some PII data, including things like date of birth, SSN, etc. All that data was in plain text. We're encrypting it, but not really needing either AI or ML.